@runa-ai/runa-cli 0.6.0 → 0.7.0

package/dist/{risk-detector-plpgsql-SGMVKYJP.js → risk-detector-plpgsql-HWKS4OLR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { stripSqlCommentsPreserveLines, buildLineStarts, lineNumberFromIndex, stripSqlForPatternMatching, detectRisksFromContent } from './chunk-3FDQW524.js';
+import { stripSqlCommentsPreserveLines, buildLineStarts, lineNumberFromIndex, stripSqlStringsPreserveLines, detectRisksFromContent, stripSqlForPatternMatching } from './chunk-3FDQW524.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 
 createRequire(import.meta.url);
@@ -1578,6 +1578,18 @@ function findKeywordFromOffset(content, start, keyword) {
   return void 0;
 }
 var MAX_DOLLAR_QUOTE_DEPTH = 50;
+function skipUntilDollarClose(content, state, openTag, depth) {
+  if (depth >= MAX_DOLLAR_QUOTE_DEPTH) return -1;
+  const nestedTag = readDollarTag(content, state.cursor);
+  if (nestedTag === void 0 || nestedTag === openTag) {
+    return state.cursor;
+  }
+  const nestedStart = state.cursor + nestedTag.length;
+  const nestedEnd = closeIndexForDollarTag(content, nestedStart, nestedTag, depth + 1);
+  if (nestedEnd === -1) return -1;
+  state.cursor = nestedEnd + nestedTag.length;
+  return state.cursor;
+}
 function closeIndexForDollarTag(content, bodyStart, openTag, depth = 0) {
   if (depth >= MAX_DOLLAR_QUOTE_DEPTH) return -1;
   const state = {
@@ -1591,12 +1603,8 @@ function closeIndexForDollarTag(content, bodyStart, openTag, depth = 0) {
     if (content.startsWith(openTag, state.cursor)) {
       return state.cursor;
     }
-    const nestedTag = readDollarTag(content, state.cursor);
-    if (nestedTag !== void 0 && nestedTag !== openTag) {
-      const nestedStart = state.cursor + nestedTag.length;
-      const nestedEnd = closeIndexForDollarTag(content, nestedStart, nestedTag, depth + 1);
-      if (nestedEnd === -1) return -1;
-      state.cursor = nestedEnd + nestedTag.length;
+    const nestedCursor = skipUntilDollarClose(content, state, openTag, depth);
+    if (nestedCursor !== state.cursor) {
       continue;
     }
     if (tryStartSingleQuote(content, state)) continue;
@@ -1785,6 +1793,27 @@ function maybeBuildUsingClauseRisk(execute, executeLine) {
     }
   };
 }
+function pushBodyStaticRisks(risks, dedupe, body, bodyStartLine) {
+  const searchableBody = stripSqlStringsPreserveLines(body);
+  if (!searchableBody.trim()) return;
+  const bodyLineStarts = buildLineStarts(body);
+  const bodyRisks = detectRisksFromContent(searchableBody, body, bodyLineStarts);
+  for (const risk of bodyRisks) {
+    const line = bodyStartLine + ((risk.line ?? 1) - 1);
+    const dedupeKey = `body:${risk.reasonCode ?? risk.description}:${line}`;
+    if (dedupe.has(dedupeKey)) continue;
+    dedupe.add(dedupeKey);
+    risks.push({
+      ...risk,
+      line,
+      evidence: {
+        source: "plpgsql body",
+        snippet: body.trim().slice(0, 200),
+        detail: `Matched ${risk.reasonCode ?? "pattern"} inside PL/pgSQL body`
+      }
+    });
+  }
+}
 function buildUnresolvedExecuteRisk(execute, executeLine, reason) {
   const clauseSuffix = execute.hasUsingClause ? " includes USING clause" : execute.hasIntoClause ? " includes INTO clause" : "";
   return {
@@ -1822,6 +1851,7 @@ function analyzeBodyRange(risks, dedupe, content, commentlessContent, lineStarts
   const declarationLine = lineNumberFromIndex(commentlessContent, range.bodyStart, lineStarts);
   maybeAddDoBlockRisk(risks, dedupe, commentlessContent, range, declarationLine);
   const body = commentlessContent.slice(range.bodyStart, range.bodyEnd);
+  pushBodyStaticRisks(risks, dedupe, body, declarationLine);
   const stringEnv = /* @__PURE__ */ new Map();
   for (const statement of splitPlpgsqlStatementsWithOffsets(body)) {
     applyStatementAssignment(statement, stringEnv);

package/dist/{status-IJ4ZWHMX.js → status-UTKS63AB.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { createCLILogger, CLIError } from '@runa-ai/runa/cli-runtime';

package/dist/{telemetry-FN7V727Y.js → telemetry-P56UBLZ2.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { createCLILogger, CLIError } from '@runa-ai/runa/cli-runtime';

package/dist/{template-check-PNG5NQ5H.js → template-check-3P4HZXVY.js}

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { getErrorMessage } from './chunk-IBVVGH6X.js';
+import { findRepoRoot } from './chunk-3WDV32GA.js';
+import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { __export, __esm, init_esm_shims, __require, __toCommonJS } from './chunk-VRXHCR5K.js';
 import { createCLILogger, CLIError } from '@runa-ai/runa';
@@ -128,6 +130,15 @@ var RUNA_ONLY_FILES = [
   "packages/database/scripts/db-sync-partition.test.ts",
   // Partition defense tests
   "packages/database/scripts/check-plpgsql.ts",
+  "packages/database/scripts/db-sync-apply-steps.test.ts",
+  "packages/database/scripts/db-sync-codegen-runtime.test.ts",
+  "packages/database/scripts/db-sync-db-state.test.ts",
+  "packages/database/scripts/db-sync-local-url.test.ts",
+  "packages/database/scripts/db-sync-pg-schema-diff.test.ts",
+  "packages/database/scripts/db-sync-schema-discovery.test.ts",
+  "packages/database/scripts/db-sync-schema-sort.ts",
+  "packages/database/scripts/db-sync-seeds-runtime.test.ts",
+  "packages/database/scripts/seed-writer.test.ts",
   "packages/database/scripts/run-splinter.ts",
   "packages/database/scripts/seed-generators/index.ts",
   "packages/database/scripts/seed-generators/loader.ts",
@@ -311,6 +322,10 @@ var INTENTIONALLY_DIFFERENT_FILES = [
   // Vercel pull vs generic setup
   "playwright.config.ts",
   // Internal paths + ESM/CJS fallback in template
+  "config/vitest/layer3-global-setup.ts",
+  // Dogfooding layer 3 setup differs
+  "config/vitest/vitest.config.layer1.ts",
+  // Dogfooding layer 1 test patterns differ
   "config/vitest/vitest.config.layer3.ts",
   // Internal SDK path vs package import
   // === Workflow Files ===
@@ -346,6 +361,18 @@ var INTENTIONALLY_DIFFERENT_FILES = [
   // Different schema exports
   "packages/database/src/schema/index.ts",
   // Different table exports
+  "packages/database/scripts/db-sync-codegen-runtime.ts",
+  // Dogfooding codegen runtime differs
+  "packages/database/scripts/db-sync-codegen.ts",
+  // PostGIS cleanup differs
+  "packages/database/scripts/db-sync-local-url.ts",
+  // Local DB discovery differs
+  "packages/database/scripts/db-sync-pg-schema-diff.ts",
+  // Direct apply helpers differ
+  "packages/database/scripts/db-sync-schema-discovery.ts",
+  // Schema cache behavior differs
+  "packages/database/scripts/db-sync-seeds-runtime.ts",
+  // Seed runtime orchestration differs
   "packages/database/scripts/generate-seeds.ts",
   // runa-specific seed logic
   "packages/database/scripts/validate-schema-consistency.ts",
@@ -358,6 +385,8 @@ var INTENTIONALLY_DIFFERENT_FILES = [
   // runa-specific seed writer
   "packages/database/scripts/seed-media/index.ts",
   // runa-specific media seeds
+  "packages/database/scripts/seed-engines/auto-seed-generator.ts",
+  // Dogfooding seed generation differs
   "packages/database/scripts/seed-engines/auto-seed-generator.test.ts",
   // runa-specific tests
   "packages/database/scripts/seed-engines/constants.test.ts",
@@ -366,6 +395,8 @@ var INTENTIONALLY_DIFFERENT_FILES = [
   // Re-export order differences
   "packages/database/scripts/seed-engines/generators/locale.ts",
   // Import style differences
+  "packages/database/scripts/seed-utils.ts",
+  // Dogfooding seed utils differ
   "packages/database/scripts/setup-db-roles.ts",
   // Role setup variations
   "packages/database/src/zod/index.ts",
@@ -1573,14 +1604,16 @@ var stateLogHandlers = {
   report: (_logger) => {
   }
 };
-function handleStateChange(snapshot, prevState, logger, jsonMode, quietMode) {
-  if (jsonMode || quietMode) return;
-  const state = getStateName(snapshot);
-  if (state === prevState) return;
-  const handler = stateLogHandlers[state];
-  if (handler) {
-    handler(logger);
+var logStateChange = createMachineStateChangeLogger({
+  getState: getStateName,
+  getContext: (snapshot) => snapshot.context,
+  handlers: stateLogHandlers,
+  shouldSkipState: (_state, _prevState, _context, extra) => {
+    return extra?.jsonMode === true || extra?.quietMode === true;
   }
+});
+function handleStateChange(snapshot, prevState, logger, jsonMode, quietMode) {
+  logStateChange(snapshot, prevState, logger, { jsonMode, quietMode });
 }
 var CATEGORY_DISPLAY_NAMES2 = {
   rules: "Rules (.claude/rules/)",
@@ -1753,28 +1786,6 @@ function printActionsNeeded(logger, actions) {
     (action) => [`   ${action.path}`]
   );
 }
-function findRepoRoot(startDir) {
-  const { existsSync: existsSync2, readFileSync: readFileSync2 } = __require("fs");
-  const { join: join3, dirname } = __require("path");
-  let current = startDir;
-  while (current !== dirname(current)) {
-    if (existsSync2(join3(current, "turbo.json"))) {
-      return current;
-    }
-    const pkgPath = join3(current, "package.json");
-    if (existsSync2(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
-        if (pkg.workspaces) {
-          return current;
-        }
-      } catch {
-      }
-    }
-    current = dirname(current);
-  }
-  return startDir;
-}
 function groupResultsByCategory(results) {
   const categoryMap = /* @__PURE__ */ new Map();
   for (const result of results) {

package/dist/{test-QYXE5UVW.js → test-V4KQL574.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { runTest, TestRunOutputSchema, CLIError, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, createCLILogger, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema } from '@runa-ai/runa';
@@ -80,7 +79,7 @@ var testDbCommand = new Command("test:db").description("Run Layer 2-3: Database
 ).option("--verbose", "Verbose output (full error details, environment info)").option("--changed", "Run only impacted layers based on git diff").option(
   "--base <ref>",
   "Base ref for --changed (default: $RUNA_TEST_BASE_REF or $GITHUB_BASE_REF)"
-).option("--layer <layer>", "Run specific layer: 2/schema, 3/api, or all (default: all)").action(async (options) => {
+).option("--skip-seed", "Skip applying seed data before Layer 2 pgTAP tests").option("--layer <layer>", "Run specific layer: 2/schema, 3/api, or all (default: all)").action(async (options) => {
   try {
     const layers = options.layer === "2" || options.layer === "schema" ? [2] : options.layer === "3" || options.layer === "api" ? [3] : [2, 3];
     const output = await runTestService({
@@ -90,6 +89,7 @@ var testDbCommand = new Command("test:db").description("Run Layer 2-3: Database
       verbose: options.verbose,
       changed: options.changed,
       base: options.base,
+      skipSeed: options.skipSeed,
       layers
     });
     emitJsonSuccess(testDbCommand, TestServiceOutputSchema, output);
@@ -105,14 +105,15 @@ var testDbCommand = new Command("test:db").description("Run Layer 2-3: Database
     );
   }
 });
-var testSchemaCommand = new Command("test:schema").description("Run Layer 2: Schema tests (Drizzle, RLS, pgTAP) - Alias for test:layer2").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").action(async (options) => {
+var testSchemaCommand = new Command("test:schema").description("Run Layer 2: Schema tests (Drizzle, RLS, pgTAP) - Alias for test:layer2").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").option("--skip-seed", "Skip applying seed data before Layer 2 pgTAP tests").action(async (options) => {
   try {
     const output = await runTestService({
       ci: options.ci ?? false,
       record: options.record,
       reportJson: options.reportJson,
       verbose: options.verbose,
-      layers: [2]
+      layers: [2],
+      skipSeed: options.skipSeed
     });
     emitJsonSuccess(testSchemaCommand, TestServiceOutputSchema, output);
   } catch (error) {
@@ -127,14 +128,18 @@ var testSchemaCommand = new Command("test:schema").description("Run Layer 2: Sch
     );
   }
 });
-var testApiCommand = new Command("test:api").description("Run Layer 3: API tests (Hono RPC, Contract, Integration) - Alias for test:layer3").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").action(async (options) => {
+var testApiCommand = new Command("test:api").description("Run Layer 3: API tests (Hono RPC, Contract, Integration) - Alias for test:layer3").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").option(
+  "--skip-seed",
+  "Include with test:api for command compatibility; effective only when Layer 2 is selected"
+).action(async (options) => {
   try {
     const output = await runTestService({
       ci: options.ci ?? false,
       record: options.record,
       reportJson: options.reportJson,
       verbose: options.verbose,
-      layers: [3]
+      layers: [3],
+      skipSeed: options.skipSeed
     });
     emitJsonSuccess(testApiCommand, TestServiceOutputSchema, output);
   } catch (error) {
@@ -412,6 +417,9 @@ async function runSingleLayer(params) {
       forceRegenerate: params.options.force,
       skipGeneration: params.options.skipGeneration,
       requireManifest: effectiveRequireManifest,
+      skipSeed: params.options.skipSeed,
+      includePropertyTests: params.options.includePropertyTests,
+      strictGeneration: params.options.strictGeneration,
       invokedAs: `runa test:layer${params.layer}`
     });
     emitJsonSuccess(params.cmd, TestRunOutputSchema, output);
@@ -486,6 +494,15 @@ function createLayerCommand(layer) {
       "Require manifest to be present and valid (fail if missing or stale)"
     );
   }
+  if (layer === 1) {
+    cmd.option(
+      "--include-property-tests",
+      "Include property-based tests for Layer 1 (default: local off, CI on)"
+    ).option("--strict-generation", "Fail if Layer 1 test generation fails (default: false)").option("--require-manifest", "Require manifest to be present and valid for Layer 1");
+  }
+  if (layer === 2) {
+    cmd.option("--skip-seed", "Skip applying seed data before Layer 2 pgTAP tests");
+  }
   if (layer >= 4) {
     cmd.option("--generate", "Generate tests from XState before running (Layer 4)").option("--advanced", "Generate advanced tests (requires --generate)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--update-snapshots", "Update visual baselines (Layer 4)").option("--filter <pattern>", 'Filter tests by pattern (e.g., "checkout-*")').option("--review-snapshots", "Interactive review of changed visual snapshots (Layer 4)").option("--force", "Force regenerate all tests, bypassing cache").option(
       "--require-manifest",
@@ -509,6 +526,12 @@ function createAliasCommand(alias, layer, description) {
   ).action(async (options) => {
     await runSingleLayer({ cmd, layer, options });
   });
+  {
+    cmd.option(
+      "--include-property-tests",
+      "Include property-based tests for Layer 1 (default: local off, CI on)"
+    ).option("--strict-generation", "Fail if Layer 1 test generation fails (default: false)").option("--require-manifest", "Require manifest to be present and valid for Layer 1");
+  }
   return cmd;
 }
 var testLogicCommand = createAliasCommand(
@@ -563,7 +586,7 @@ var testServiceCommand = new Command("test:service").description("Run Layer 1-3:
 ).option("--verbose", "Verbose output (full error details, environment info)").option("--changed", "Run only impacted layers based on git diff").option(
   "--base <ref>",
   "Base ref for --changed (default: $RUNA_TEST_BASE_REF or $GITHUB_BASE_REF)"
-).action(async (options) => {
+).option("--skip-seed", "Skip applying seed data before Layer 2 pgTAP tests").action(async (options) => {
   try {
     const output = await runTestService({
       ci: options.ci ?? false,
@@ -571,7 +594,8 @@ var testServiceCommand = new Command("test:service").description("Run Layer 1-3:
       reportJson: options.reportJson,
       verbose: options.verbose,
       changed: options.changed,
-      base: options.base
+      base: options.base,
+      skipSeed: options.skipSeed
     });
     emitJsonSuccess(testServiceCommand, TestServiceOutputSchema, output);
   } catch (error) {

package/dist/{test-gen-QPWOIEHU.js → test-gen-FS4CEY3P.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { createCLILogger, updateGoldenRecord, CLIError, generateE2ETests, TestE2EGenerateOutputSchema, generateSecurityTests, TestSecurityGenOutputSchema, generateUnitTests, TestUnitGenOutputSchema, generateApiTests, TestApiGenOutputSchema, generateComponentTests, TestComponentGenOutputSchema, generateE2EScaffold } from '@runa-ai/runa';

package/dist/{upgrade-3SLWVNAC.js → upgrade-NUK3ZBCL.js}

@@ -1,15 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { fetchTemplates } from './chunk-XJBQINSA.js';
+import { fetchTemplates } from './chunk-SGJG3BKD.js';
 import { updateRunaConfigSdkVersion } from './chunk-6AALH2ED.js';
-import './chunk-RZLYEO4U.js';
 import './chunk-DRSUEMAK.js';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import './chunk-RZLYEO4U.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
-import { createCLILogger, CLIError, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, preCheckSync, findConflictFiles } from '@runa-ai/runa';
+import { createCLILogger, CLIError, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, findConflictFiles, preCheckSync } from '@runa-ai/runa';
 import { Command } from 'commander';
 import { execa } from 'execa';
 
@@ -468,6 +467,19 @@ async function executeTemplateSync(ctx, templatesDir) {
   });
   emitJsonSuccess(upgradeCommand, SyncOutputSchema, result);
   logHumanOutput(logger, result, options);
+  if (result.summary.conflicts > 0 && !options.preview) {
+    const conflictFiles = findConflictFiles(result.changes);
+    throw new CLIError(
+      `${result.summary.conflicts} file(s) have unresolved merge markers`,
+      "UPGRADE_UNRESOLVED_CONFLICTS",
+      [
+        `Files: ${conflictFiles.slice(0, 5).join(", ")}${conflictFiles.length > 5 ? ` and ${conflictFiles.length - 5} more` : ""}`,
+        "Resolve merge markers in the files listed above",
+        "Then run: runa check (to verify no markers remain)",
+        "Or re-run: runa upgrade --force (to overwrite with SDK version)"
+      ]
+    );
+  }
 }
 async function executeVerification(logger) {
   const verificationPassed = await runVerification(logger);

package/dist/{validate-SM4PXPS7.js → validate-CAAW4Y44.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { createCLILogger, validateConfig, ValidateConfigOutputSchema, CLIError } from '@runa-ai/runa';

package/dist/{vuln-check-TYQNEFS7.js → vuln-check-2W7N5TA2.js}

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { createCLILogger } from '@runa-ai/runa';
@@ -72,7 +71,7 @@ var vulnCheckCommand = new Command("vuln-check").description("Run comprehensive
   const logger = createCLILogger("vuln-check");
   const isJsonMode = getOutputFormatFromEnv() === "json" || options.format === "json";
   try {
-    const { VulnChecker } = await import('./vuln-checker-2QXGN5YT.js');
+    const { VulnChecker } = await import('./vuln-checker-IQJ56RUV.js');
     const categoryMap = {
       code: ["injection", "auth", "crypto"],
       deps: ["dependency"],